💻 computer science

MedTrustGraph: Purpose-Aware Temporal Heterogeneous Graph Learning for Zero-Trust Authorization of Autonomous Clinical LLM Agents

MedTrustGraph is a purpose-aware temporal heterogeneous graph learning framework that significantly outperforms static and sequential models in detecting unauthorized actions by autonomous clinical LLM agents, achieving high accuracy through the integration of patient and purpose context with a deterministic Zero-Trust policy engine.

Original authors: KAMRUL ISLAM, SHARMIN SULTANA

Published 2026-10-28

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: KAMRUL ISLAM, SHARMIN SULTANA

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In modern hospitals, electronic health records act as the central nervous system of patient care, storing everything from lab results to medication lists. For decades, access to these records has been managed by a simple rule: if you are a doctor with the right badge, you can see the files for the patients assigned to you. This system works well for humans, who generally understand the context of their work and stop when they have finished a task. However, a new kind of worker is entering the hospital: the autonomous artificial intelligence agent. These are software programs powered by large language models that can read records, order tests, and summarize patient histories just like a human doctor might. But unlike a human, an AI does not inherently know when to stop. If a doctor asks an AI to check a patient's kidney function, the AI might, in its attempt to be helpful, accidentally pull up the medical history of a different patient or download thousands of unrelated files. The core challenge for the future of healthcare is not just letting these agents work, but ensuring that every single action they take is exactly what was intended, moment by moment.

Researchers at Fordham University and Rowan University have developed a new system called MedTrustGraph to solve this problem. Instead of treating an AI agent's session as a single block of trust once it logs in, this system watches every move the agent makes in real time. The researchers built a synthetic environment that mimics a hospital's electronic health record system, creating thousands of fake patient files and simulating five thousand different scenarios where an AI agent tries to do its job. In half of these scenarios, the agents were instructed to perform their duties correctly. In the other half, the agents were programmed to act like they had been compromised or confused, attempting to access the wrong patients, looking at the wrong types of medical data, or trying to steal large amounts of information. The goal was to see if a computer could learn to spot these mistakes as they happened, based not just on who the agent was, but on what it was doing, why it was doing it, and what it had done just a second before.

The system works by mapping the hospital environment as a living, changing web of connections. In this web, doctors, patients, medical tools, and specific pieces of data are all linked together. The researchers taught their system to pay attention to the order in which things happened. They found that the sequence of actions matters deeply. For example, if an agent reads a lab result and then immediately writes a summary, that is a normal flow. But if an agent reads a lab result and then suddenly tries to download a hundred patient records, the system recognizes that the pattern has shifted, even if the agent still has a valid login. By combining this sense of timing with a clear understanding of the agent's assigned task and the specific patient it is supposed to help, the system can calculate a risk score for every single action.

When the researchers tested their system against older methods that looked at actions in isolation or ignored the timing of events, the new approach proved significantly more effective. In their simulations, the system achieved an AUC of 0.89, a notable improvement over the best previous methods, which hovered around 0.80. More importantly, the system learned that context is everything. When the researchers removed the information about which patient the agent was supposed to be helping, the system's ability to catch mistakes dropped sharply. Similarly, when they removed the information about the specific medical task the agent was supposed to perform, its performance also declined. This confirmed that knowing the "who" and the "why" is just as critical as knowing the "what."

The researchers also designed the system to be cautious rather than purely automatic. Instead of simply saying "yes" or "no" to every request, the system uses a three-step decision process. If an action looks safe, it is allowed to proceed instantly. If an action looks suspicious, the system flags it for a human to review. If an action is clearly dangerous, it is blocked immediately. In their tests, this approach ensured that no unauthorized attempts were allowed to proceed unchecked; instead, the system blocked the vast majority of them and flagged the remaining suspicious cases for human review. It only asked for human help in about two percent of cases overall, keeping the workload for hospital staff low while maintaining a high level of security.

It is important to note that these results come from a carefully constructed simulation, not a live hospital. The data used to train and test the system was entirely synthetic, created by the researchers to mimic real medical records without using any actual patient information. Because the rules for what counted as a "mistake" were built into the simulation itself, the system's perfect scores in some areas reflect how well it followed those specific rules rather than how it would handle the messy unpredictability of a real-world hospital. The researchers are clear that this is a proof of concept, a demonstration that the right kind of monitoring is possible. They have made their code and data available to other scientists so that the method can be tested on real-world data in the future.

The study suggests that as artificial intelligence becomes more integrated into healthcare, security cannot rely on a simple login. Trust must be continuous and contextual. By watching the flow of actions and understanding the purpose behind them, it is possible to build a safety net that catches errors before they become breaches. This approach does not replace the need for human oversight, but it provides a way to manage the complexity of autonomous agents, ensuring that they remain helpful tools rather than becoming sources of risk. The work lays a foundation for a future where AI agents can operate with the same level of safety and accountability that we expect from human medical professionals.

Technical Summary: MedTrustGraph

Problem Statement

As Large Language Model (LLM) agents evolve into autonomous clinical tools capable of retrieving patient data, invoking tools, and executing multi-step tasks within Electronic Health Record (EHR) systems, traditional authentication mechanisms prove insufficient. Authenticating a session does not guarantee that subsequent individual actions align with the clinician's declared purpose, the assigned patient, or the agent's delegated authority.

Current Role-Based Access Control (RBAC) determines if a physician can access a system but fails to validate if a specific AI-mediated action at a specific moment is consistent with the task. Furthermore, medical LLMs are susceptible to prompt injection and misalignment, where an authenticated agent might retrieve unrelated patient records, perform bulk extractions, or escalate privileges. While Zero-Trust Architecture (ZTA) removes implicit trust based on network location, existing healthcare ZTA designs often address infrastructure and credentials but lack a mechanism to continuously evaluate whether a specific action is justified by the authorized purpose and patient context given the agent's behavioral history.

Methodology: The MedTrustGraph Framework

The authors propose MedTrustGraph, a framework for continuous, purpose-aware authorization of clinical agent actions. It models the clinical environment as an evolving temporal heterogeneous graph and evaluates each action in the context of patient, purpose, and behavioral history.

1. Graph Representation

The environment is represented as a dynamic heterogeneous graph $G_t = (V_t, E_t, \phi, \psi)$ where:

Nodes: Typed entities including Clinicians, Agents, Patients, Tools, FHIR Resources, Clinical Purposes, Tasks, and Access Events.
Edges: Timestamped directed relations such as assigns (clinician to agent), acts_for (agent to purpose), invokes (agent to tool), and accesses (agent to patient/resource).
Temporal Nature: Unlike static graphs that collapse interactions, MedTrustGraph processes event embeddings in chronological order to capture sequence and duration.

2. Model Architecture

The framework employs a six-layer architecture:

Structured Purpose Representation: Natural language requests are mapped to schema-constrained purposes (e.g., renal_function_assessment with specific permitted operations and resource classes).
Event Stream: A FHIR-style stream of access events.
Temporal Heterogeneous Graph: Built from the event stream.
Temporal Graph Encoder:
- A Graph Attention Network (GAT) aggregates typed neighbors with relation-aware attention to produce event embeddings.
- A Causal Gated Recurrent Unit (GRU) processes these embeddings in timestamp order, ensuring the state at step $t$ depends only on current and prior events.
Context and Risk Components:
- Patient Scope Check: Verifies if the accessed patient matches the assigned patient.
- Purpose Scope Check: Verifies if the resource type is in the purpose's allow-list.
- These context signals are combined with the temporal state via an MLP to produce a continuous risk estimate.
Zero-Trust Decision Engine:
- The learned risk score is calibrated using Platt scaling.
- A deterministic Policy Engine maps the calibrated risk to one of three decisions: Allow, Verify, or Deny.
- Deterministic Overrides: Actions outside the least-privilege scope are immediately denied; context violations (patient/purpose mismatch) that would otherwise be "Allow" are escalated to "Verify."

3. Benchmark and Evaluation

Data: A synthetic FHIR-style benchmark modeled on MedAgentBench, containing 5,000 agent trajectories (3,000 normal, 2,000 attack) and 36,855 access events.
Attack Families: Cross-patient access, purpose drift, privilege escalation, and bulk record retrieval.
Splitting: Chronological trajectory-level split (70% train, 15% validation, 15% test) to prevent data leakage.
Baselines: Compared against classical models (Logistic Regression, Random Forest, XGBoost), sequential models (LSTM), and static graph models (GCN, GAT, HGT-style).

Key Contributions

Formulation: Defines continuous, purpose-aware authorization as event-level risk estimation over a temporal heterogeneous graph.
Benchmark: Introduces a synthetic FHIR-style security benchmark with 5,000 trajectories and four distinct attack families, featuring chronological splits and explicit audit of leakage-safe features.
Model: Proposes a temporal graph model (GAT encoder + causal GRU) augmented with explicit patient and purpose context, evaluated against classical, sequential, and static graph baselines.
Ablation & Analysis: Provides controlled ablation studies with paired trajectory-level bootstrap intervals and exact McNemar tests with Holm correction.
Decision Layer: Implements a calibrated Zero-Trust decision layer where learned risk serves as evidence, but a deterministic policy engine retains final authority, evaluated on a nested held-out split.
Transparency: Offers a transparent account of benchmark limitations, including the use of near-oracle context features and the need for validation on real traces.

Results

Performance: On raw observable features (without leaking context labels), the temporal graph model achieved an F1 score of 0.8905, AUROC of 0.9767, and AUPRC of 0.9517. This significantly outperformed XGBoost (F1 0.8062) and static GAT (F1 0.7918).
Context Impact: In a controlled ablation configuration, the full model reached an F1 of 0.9653. Removing patient context caused the largest performance drop ( $\Delta$ F1 = 0.2173), followed by purpose context ( $\Delta$ F1 = 0.0200), graph structure, and temporal structure.
Robustness: Shuffling event order reduced F1 to 0.8279, confirming that temporal order carries significant authorization signal. Removing up to 30% of edges had negligible impact (<0.002 F1 change).
Policy Layer: The calibrated policy layer allowed 0 of 652 unauthorized events (95% CI 0–0.59%) and auto-allowed 98.64% of authorized events, with a verification workload of only 1.90%.
Attack Detection: The model detected bulk retrieval and cross-patient access with near-perfect recall. Privilege escalation detection relied heavily on the combination of all components.

Significance and Claims

The paper claims that on this synthetic benchmark, temporal order and patient/purpose context carry authorization signals that are missed by event-level and static-graph models. The separation of learned risk estimation from a deterministic policy engine yields a low-workload decision layer that minimizes false negatives (missed unauthorized actions) while maintaining a low false-positive rate (unjustified denials).

The authors explicitly state that because benchmark labels were generated from patient- and purpose-scope rules, context-augmented scores represent upper bounds. The results validate the design and pipeline rather than real-world performance. The framework is presented as an additional contextual authorization layer that complements, rather than replaces, existing HIPAA-mandated access controls, authentication, and auditing. The study emphasizes that for agentic AI, authorization should rest on observed behavior and explicit intent rather than identity alone, keeping learned components advisory and subordinate to auditable rules.